Zero knowledge convincing protocol on quantum bit is impossible 
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It is one of fundamental feature of quantum formal- 
ism that on one hand it provides a new information 
processing resources and on the other hand putting 
fundamental constraints on the processing of quan- 
tum information implying "no-go" theorems about 
no cloning [Jj]-|3|, no bit commitment |QJS[ no deleting 
|Q] in quantum theory. Here we ask about possibility 
of "zero knowledge" scenario which, for its simplicity, 
can be considered as the quantum primitive or model 
scenario for any problems of similar kind. Consider 
two parties: Alice and Bob and suppose that Bob is 
given a qubit system in a quantum state <f>, unknown 
to him. Alice knows (f> and she is supposed to con- 
vince Bob that she knows (f> sending some test mes- 
sage. Is it possible for her to convince Bob providing 
him "zero knowledge" i. e. no information about <f> 
he has? We prove that there is no "zero knowledge" 
protocol of that kind. In fact it turns out that basing 
on Alice message, Bob (or third party - Eve - who 
can intercept the message) can synthetize a copy of 
the unknown qubit state <j> with nonzero probability. 
This "no-go" result puts general constrains on infor- 
mation processing where information about quantum 
state is involved. 

Consider first the most general test message from Al- 
ice. It can involve some classical information (some data, 
function encoded in classical bits) as well as purely quan- 
tum information represented by quantum register or, in 
other words, quantum system in some state. In her mes- 
sage she can, for example order to perform quantum com- 
puting of some problem and foresee the result or even - 
in general - she can order Bob to run both quantum and 
classical Turing machines to check some of her predic- 
tions. She must make some predictions however, as the 
message is supposed to test her knowledge. Thus, in gen- 
eral, Bob must perform some measurement to check her 
predictions. 

The general form of test message within quantum for- 
malism .- All the above can taken into account in the 
test message (or test in brief) sent form Alice to Bob 
consisting of three elements (i) classical prescription of 
some quantum operation, (ii) possibly - some ancilla in 
quantum state Alice prepared together with (iii) result 
of the operation. The quantum operation is supposed to 
act in general on both ancilla and Bob's state, but this 
action could be in particular trivial i. e. not affecting 
some of them at all. Note that all classical information 
(say classical bits as classical Turing machine etc.) can 
be included in the description of quantum operation. In 



fact it can be states of ancillas prepared by Bob. This 
is because Bob is supposed to perform finally the mea- 
surement in which his qubit as well as Alice ancilla are, 
in general, supposed to subject. All the results of Bob 
operation (even if there is more than one) predicted by 
Alice can be included in some multiindex or set of multi- 
ndices corresponding to output of general quantum mea- 
surement. 

The conditions for convincing test messages .- Let us 
now consider what it would mean to convince Bob in the 
above scenario or, in other words, which test message 
from Alice to Bob is convincing? It is obvious that if Alice 
knows the state and she wants to convince Bob about it 
then the result of the operation she predicts must occur 
with probability one i. e. with certainty. But it is not all: 
Alice could try to cheat proposing the operation which 
would give some result with certainty independently on 
her knowledge about <f>. For example Alice could order 
Bob to prepare the spin-i in state "up" | fg) and predict 
that if he measures the spin component of the particle 
along z then he will get result "up". Of course, Alice 
prediction is right with probability one but has nothing 
to do with her knowledge about <j> at all. To avoid this the 
convincing test message should have the property that if 
Alice does not know <j> then there is nonzero probability 
that the result she gives (as prediction) to Bob will not 
occur i. e. there is nonzero probability of revealing that 
she cheats. We can summarise the above in the following 

Condition 1 .- Any convincing test message from Alice 
to Bob should have the property that Alice's prediction 
occurs with certainty if and only if she knows the state <j>. 

There is, however, the problem that Alice can send to 
Bob the convincing test message, but he may not be able 
to check whether the condition 1 is satisfied i. e. whether 
the result of the test is not independent on Alice knowl- 
edge about (j>. On the other hand checking whether the 
test satisfies the condition he could be forced to destroy 
some quantum information (which can not be cloned) 
about the test and will not be able to carry out the test 
(or any test equivalent to it). To avoid those two possibil- 
ities of that kind we shall postulate the natural condition 

Condition 2 .- For any convincing test message Bob 
must be able to check the condition 1 for the message in 
such a way that he is still can find out whether the test 
itself works. 

Any test message satisfying conditions 1 and 2 we shall 
call convincing. First we shall prove that convincing mes- 
sages exist. Consider the following protocol. Alice sends 
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Bob only classical message (with no ancilla): "Please 
measure the spin value along the axis n. You will cer- 
tainly get result "up" . This corresponds to the state 
you have". From the above Bob can see himself that 
the protocol satisfies the condition 1 as if Alice does not 
know the state exactly (up to some phase factor) then 
from her point of view it is random with some nontrivial 
probability distribution. So it is likely that <f> has both 
"up" and "down" components nonzero along n i. e. that 
4> = oc\ Tfi) + P\ in) with 0^0. Then there is nonzero 
probability of result "down" contrary to what Alice pre- 
dicted. The above protocol is based on "convincing" test. 
But if Alice is honest and wants to convince Bob then she 
gives him (or the third party - Eve - who can eavesdrop) 
the full information about <f>. Indeed then it is "up" eigen- 
vector along the n axis he is told about. Obviously it is 
not zero knowledge protocol as the full information about 
\<fi) has been transferred from Alice to Bob. 

Fully classical protocols .- Below we shall focus on the 
protocols, which we call fully classical ones in which there 
is only classical information transfer from Alice to Bob. 
We shall briefly prove the following observation 

Observation .- To make the convincing test nontrivial 
i. e. not carrying all information about <f> the transfer of 
quantum information (represented by ancilla) form Alice 
to Bob is necessary. In other words fully classical proto- 
cols are completely trivial from "zero knowledge" point of 
view. 

As we discussed before all classical part of message can 
be included in the classical description of some quantum 
operation and its result which Alice predicts. The most 
general quantum operation Bob can perform on the state 
is the generalised quantum measurement mathematically 
represented by completely positive map. According to 
general results of quantum measurement theory it can 
be written as follows 

i 

where J^vVj V£ ^ s equal to 2 x 2 identity matrix. The 
indices i correspond to elementary results of the mea- 
surement. The most general result predicted by Alice 
can be that the Bob result io will belong to some subset 
of indices /. Now we ask about the information which 
is carried in Alice test message if she does not cheat. 
Then her prediction must occur with probability one. In 
quantum measurement theory it means that 

p = Tr(£,V?V i \<f>)(4>\) = l (2) 
iei 

On the other hand, the measurement theory asserts that 
the hermitian operator X — Yliei^i^i nas eigenvalues 
A satisfying < A < 1. So (H) means that \<f>) is an eigen- 
vector of X. We have , however, one more condition for 
test message to be convincing: if Alice does not know the 



state than there must be nonzero probability of revealing 
it. This means that in such case the result she predicted 
should occur with probability strictly less then one. This 
can be very simply expressed as 

p' = Tr(J2 ^VtWW\) < 1 for any </>' ? </>. (3) 
iei 

But, following the spectral property of X it means that 
the state \cj>) is the only eigenvector of X corresponding 
to the eigenvalue A = 1. Bob (or Eve) does not know 
the state. But he is given description of Vi-s and the set 
of indices on the paper (or, say, computer disc) . He can 
now calculate X, diagonalise, find the unique eigenvector 
corresponding to unit eigenvalue - the vector is nothing 
but 4>. He can finally perform the physical measurement 
of the observable X on his particle to test whether the 
Alice message protocol works (i. e. whether she does 
not cheats). Let us summarise. If Alice knows <f> and 
wants to convince Bob about it sending only classical 
information, then any test message form her must contain 
full information about the Bob's state cj). Bob is able 
to get the information and still check whether her test 
operation works. The crucial observation here is that 
given the operation and result description in two sets {Vi} 
(of operators) and I (of indices) instead of following the 
protocol provided by Alice Bob can test Alice knowledge 
in much simpler way: calculating, analysing and finally 
measuring the observable X = X^e/ ^iVi ■ Note, by the 
way, that if third party "Eve" copies the message then 
she also gets full information about <j>. 

Now one can ask whether quantum information trans- 
fer from Alice to Bob can reduce significantly the infor- 
mation content about <fi. The answer is positive and is 
contained in the following protocol. 

Symmetric projection convincing protocol .- As an an- 
cilla Alice sends Bob another copy of <j> (she can pre- 
pare it as she knows the state) and says that the joint 
measurement projecting the states of both original par- 
ticle and the ancilla onto the symmetric subspace will 
certainly give positive result. It is easy to see that the 
above protocol satisfies both conditions 1 and 2 which 
any convincing test should satisfy. Still Bob can not get 
more information than the optimal information about un- 
known <p extracted from two copies of it. It is known that 
such information is far from full one, nevertheless, it is 
strictly more than the information one can extract from 
one copy. Indeed, if one consider <f> as being chosen ran- 
domly by some previous preparer (who was further in 
contact with Alice and Bob) then one can introduce the 
fidelity of estimation of (f> : 

/= f wmtestm? (4) 

Jtf> 

where integral is calculated over uniform distribution of 
all pure qubit states and 4> es t{4>) is the state estimated 
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under the presence of state 0. It is known that optimal 
extraction of information from one copy (say, before Bob 
is given an ancilla) is ficopy — 2/3, while in the presence 
of two copies we have fico-pies — 3/4. So in the above pro- 
tocol (which can be called symmetric convincing "projec- 
tion (SCP) protocol still there is a nontrivial information 
transfer about the state from Alice to Bob: after receiv- 
ing the test message from Alice Bob can learn more about 
it (on average 3/4 in terms of fidelity) than if he were 
given the state alone (resp. 2/3). If Eve intercepted the 
complete message (with the ancilla) she also gets nonzero 
knowledge about with fidelity fi cop y = 2/3 instead of 
focopy = 1/2. Note that in the case of fully classical pro- 
tocol the fidelity is f c i = 1. So the above SPC protocol 
is a legitimate convincing one, being much more closer 
to hypothetical "zero knowledge" than any fully classical 
protocol. But it is still not a "zero knowledge" one. 

Proof of nonexistence of perfect "zero knowledge" pro- 
tocol .- Here we shall prove that any protocol with test 
message satisfying condition 1 (and hence any convinc- 
ing Alice message) has to carry nontrivial information 
about Bob state 0. There is even more than that. As we 
shall see basing on message satisfying condition 1 Bob (or 
Eve) can reproduce with some nonzero probability un- 
known state from the ancilla. Suppose that Alice sends 
Bob the ancilla in, in general, mixed state g defined on 
the Hilbert space 'HancUia of arbitrary (may be infinite) 
dimension, the classical description of quantum opera- 
tion {Vi} (which, in general, is to be carried out on both 
the Bob qubit and the ancilla), and the set of indices I 
corresponding to the result io G I. The mixed state g 
describes the ancilla which can be hydrogen atom, pho- 
ton with a given state of its polarisation, molecule with 
the state of nuclear spin prepared etc. The Bob qubit 
can be defined as a pure state of spin state of spin-half 
particle, state of effectively two level atom and so on. So 
the model is completely general from the physical point 
of view. 

After similar considerations as in the case of fully clas- 
sical protocols it can be seen that condition 1 is satisfied 
if and only if the mean values of the following observable 
A = J2iei Vi^i (built on the basis of Alice classical part 
of message) satisfy: 



Tr(A e ® = 1, 



Tr{Ag®\(j>')(4>'\) < 1 for any0' ^ 0. 



(5) 
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Note that, as before, the observable A has to have eigen- 
values from the interval [0, 1]. So the condition (|J) says 
that the joint state |0) (0 has eigenvectors belong 
to the (may be degenerated) eigensubspace of A corre- 
sponding to eigenvalue 1. Let us denote the projector 
onto that subspace as Pa and the orthogonal projection 
as P^ . They both correspond to the subspaces in the full 
Hilbert space Tt = H anc ai a ® TL qu bit ■ First note that Pa 



can not span the full TC because then A would be iden- 
tity and clearly the condition (0) could not be satisfied. 
Hence Pj± is represented by nonzero set of its eigenvectors 
{\^k)}k=i from the full space TC where N can be, in gen- 
eral, infinite. From the general theory of Hilbert spaces 
we have \^k) = Wk <8> singlet)- Here we have the op- 
erators Wk : Tiqubit — * Tianciiia (which can be calculated 
explicitly from Schmidt decomposition of the correspond- 
ing vectors ^k) and the familiar two-qubit singlet state 
\^singlet) = (I Tzlz) - | izTz})- Now a little algebra 
leads to the conclusion that condition (||) is equivalent to 



Tr(W fc t ^ fc |0 ± )(0 ± |) = O 



(7) 



for all k = 1,...,N. Here |0^) represents the (unique) 
qubit state orthogonal to |0). To derive (0) one uses 
the identity (see, for instance, 0) I0 1 -) = \cr y <j)*) where 
o~ y = i\ tz)(!z I — i\ iz){]z | is familiar Pauli matrix 
and star * stands for complex conjugation. Note that we 



have Wt : TC a 



H 



qubit ■ 



So the hermitian operator 



W^gWk with positive spectrum is defined on one qubit 
Hilbert space. For (^) is equivalent to (||) at least of 
2x2 matrices {WlgWk} must not vanish as otherwise 
(0) could not be satisfied. So for at least one index fc we 
have 



Pko ^Tr(wt o gW ko )>0 



(8) 



Elementary analysis leads to the conclusion that the ma- 
trix Wl g gWk must represent projection onto the vector 
orthogonal to 0^ . But it means that 
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(9) 



Bob does not know any of fco, g, 0. But he can easily 
compute all Wk inferring (as it was done above) from Pa 
calculated on basis of quantum operation description of 
which he got from Alice. Suppose now that Alice knows 
the state and wants to convince Bob about it. Bob first 
performs the measurement of A. If he got positive result 
(i. e. corresponding to eigenvalue 1) then he takes the 
ancilla (in state g) and performs the quantum measure- 
ment operation corresponding to operators 
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(10) 
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With nonzero probability (||) p ka he will can get the state 

— — = 10) (01. So there is nonzero chance that he 

will synthetize the second copy of unknown qubit state 
0. We must emphasise that once Bob gets the second 
copy of in his lab, he knows bout it, as the presence of 
the second copy is guaranteed whenever he gets positive 
result of the measurement (O). Note that if Eve gets 
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the full Alice message she have a chance to reproduce 
the Bob's qubit state in the same manner. So we have 
proved that any convincing message has to carry highly 
nontrivial information about <f>. In the case of SPC proto- 
col this information about <p can be made secure against 
Eve attack just by teleporting the second copy of <j> from 
Alice to Bob. 

If we assume that (f> is supposed be completely ran- 
dom we can express the result in terms of fidelities of 
type ([§)[§]■ To this end consider the hidden variable 77 
helping Alice to choose the concrete form of convincing 
message she sends if Bob has state </>. The message is in- 
dexed by 77, <f> and is chosen, in general with probability 
P(?7, cj>). Note that here, in particular, we allow Alice de- 
cisions to be completely random. Let Q((f>) be a uniform 
distribution on pure qubit states <p and let p(r],(f)) repre- 
sent the probability (||) which generally can (indirectly) 
depend on 77 and <p. Now consider first the information 
gain Eve can get if she intercept the message. Then she 
can perform the measurement (|Io|). If she gets the copy 
(which can happen with nonzero probability) then she 
performs optimal estimation on basis of one copy which 
involves choice of random variable rh - the axis in threed- 
imensional space (see M for details) . The fidelity of Eve 
inference can be calculated to be 

fEve = focopy + J ' dndcjydmP '(77, 4>)Q{(f))p{-q , (j)) X 

x (\(4'\4'est(4' i m})\' 2 - focopy) = focopy + A 

The integral over random parameter 771 nullifies possi- 
ble results of deliberated Alice actions to unable eaves- 
dropping inference. After performing the integral we 
have A = J dnd(/)P(rj,(l))Q((f>)p(n 1 (j>)(f lcopy - focopy) 
j dr]d<frP(r],<j))F(ri,(f>). As there always exists strictly 
positive pk the function p(j],<j)) is strictly positive on 
the whole probability space, hence A is an integral on 
the function F positive everywhere. Thus A > and 



fEve ^ focopy 



(11) 



So we have proved formally in terms of fidelities that Al- 
ice her message necessarily carries the information about 
Bob's state (f>. The similar analysis can be performed to 
show that fsob > ficopy Both above observations ex- 
press impossibility of "zero-knowledge" convincing pro- 
tocol on quantum bit. If instead of qubit one has higher 
spin system, then the problem becomes a little more 
complicated, but still it can be shown that no "zero- 
knowledge" protocol exists and it can be generalised to 
mixed states JlO[ . 

Finally it is worth to note that Alice is supposed to con- 
vince Bob of her classical knowledge about quantum state. 
The tests of that kind can be of practical significance in 
future. If quantum computers eventually are constructed 
the question of knowledge about quantum databases con- 
tent will probably be important from the point of view of 



data security (for example to test whether someone could 
have created given data which are under investigation). 

On the other hand the analysis of problems of the 
above kind provides us new features of interrelation of 
classical and quantum information: as we have seen Al- 
ice sends classical text, as well as some quantum state, 
so the above model problem satisfies the paradigm where 
classical and quantum levels of information are, in gen- 
eral, supposed to "interact" Some implications of 
the present result concerning nature of quantum informa- 
tion will be considered elsewhere. From practical point of 
view it would be interesting to consider the result in con- 
text of quantum computing involving single pure quan- 
tum bit iin. 
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